What is the primary purpose of input validation in secure software development?

To ensure data conforms to expected formats and reject malicious input

To improve application performance

A company is setting up a remote access solution for employees. They want to ensure that all traffic between the employee's device and the corporate network is encrypted and that the employee's device is compliant with security policies before it can access the network. Which solution should they use?

A web application firewall (WAF) for remote access

A remote desktop protocol (RDP) directly to internal servers

A VPN with endpoint compliance checks (e.g., NAC)

A simple username and password login to a web portal

In a Public Key Infrastructure (PKI), what is the role of a Certificate Authority (CA)?

To issue and digitally sign certificates

An organization is implementing a PKI to issue certificates to employees for email signing and encryption. The security team wants to ensure that if an employee's private key is compromised, the certificate can be revoked and other parties will be informed. Which PKI component is specifically responsible for maintaining and distributing revocation information?

Certificate Revocation List (CRL) published by the Certificate Authority (CA)

GIAC Information Security Professional

Domain 2Objective 1

Security Architecture and Engineering GISP Practice Questions (Page 13)

Part of the Security Architecture and Operations domain, which makes up ~43% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 240-minute exam (~95–160 total, ~41–69 in this domain), expect 14–23 from this objective — we provide 65 practice questions to prepare you well beyond it. (estimate)

65questions here

13free pages

12concepts

Questions 61–65

61application · medium
A financial institution is implementing a system to ensure that no single employee can both create a vendor and approve a payment to that vendor. Which security model directly supports this requirement?
Select an answer first
62foundation · easy
What is the primary purpose of input validation in secure software development?
Select an answer first
63expert · hard
A company is setting up a remote access solution for employees. They want to ensure that all traffic between the employee's device and the corporate network is encrypted and that the employee's device is compliant with security policies before it can access the network. Which solution should they use?
Select an answer first
64foundation · easy
In a Public Key Infrastructure (PKI), what is the role of a Certificate Authority (CA)?
Select an answer first
65application · medium
An organization is implementing a PKI to issue certificates to employees for email signing and encryption. The security team wants to ensure that if an employee's private key is compromised, the certificate can be revoked and other parties will be informed. Which PKI component is specifically responsible for maintaining and distributing revocation information?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to GISP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GISP” is a trademark of its owner, used for identification only.

Security Architecture and Engineering GISP Practice Questions (Page 13)

Questions 61–65

A financial institution is implementing a system to ensure that no single employee can both create a vendor and approve a payment to that vendor. Which security model directly supports this requirement?

What is the primary purpose of input validation in secure software development?

In a Public Key Infrastructure (PKI), what is the role of a Certificate Authority (CA)?

Keep studying — Security Architecture and Operations